feat(auth): store the token signing secret in the metadata layer

- app_settings table (PostgreSQL migration 000010, SQLite 000002)
- internal/settings repository (Get/Set/Ensure) wired into store.Repos
- secret generated with crypto/rand on first start and persisted; reused on restart
- drop required JWT_SECRET from env/config; app.New takes a TokenManager and
  storage.Open takes the resolved secret (URL_SECRET still overrides)
- docs updated

backend/internal/repo/contract/contract.go

@@ -15,6 +15,7 @@ import (
 	"shared-album/internal/models"
 	"shared-album/internal/notifications"
 	"shared-album/internal/photos"
+	"shared-album/internal/settings"
 	"shared-album/internal/sharelinks"
 	"shared-album/internal/social"
 )
@@ -29,6 +30,7 @@ type Repos struct {
 	Social        social.Repository
 	Notifications notifications.Repository
 	ShareLinks    sharelinks.Repository
+	Settings      settings.Repository
 	Reset         func(ctx context.Context) error
 }
 
@@ -47,6 +49,7 @@ func Run(t *testing.T, r Repos) {
 		{"Social", testSocial},
 		{"Photos", testPhotos},
 		{"Objects", testObjects},
+		{"Settings", testSettings},
 	}
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {
@@ -523,6 +526,30 @@ func testObjects(t *testing.T, ctx context.Context, r Repos) {
 	}
 }
 
+func testSettings(t *testing.T, ctx context.Context, r Repos) {
+	v, err := r.Settings.Ensure(ctx, settings.JWTSecretKey, func() (string, error) { return "generated-1", nil })
+	if err != nil || v != "generated-1" {
+		t.Fatalf("ensure first: %v %q", err, v)
+	}
+	v2, err := r.Settings.Ensure(ctx, settings.JWTSecretKey, func() (string, error) { return "generated-2", nil })
+	if err != nil || v2 != "generated-1" {
+		t.Fatalf("ensure not idempotent: %v %q", err, v2)
+	}
+	got, ok, err := r.Settings.Get(ctx, settings.JWTSecretKey)
+	if err != nil || !ok || got != "generated-1" {
+		t.Fatalf("get: %v ok=%v %q", err, ok, got)
+	}
+	if _, ok, _ := r.Settings.Get(ctx, "missing"); ok {
+		t.Fatalf("missing key reported present")
+	}
+	if err := r.Settings.Set(ctx, settings.JWTSecretKey, "rotated"); err != nil {
+		t.Fatalf("set: %v", err)
+	}
+	if got, _, _ := r.Settings.Get(ctx, settings.JWTSecretKey); got != "rotated" {
+		t.Fatalf("set not applied: %q", got)
+	}
+}
+
 func contains(list []string, v string) bool {
 	for _, x := range list {
 		if x == v {

backend/internal/repo/contract/postgres_test.go

@@ -17,6 +17,7 @@ import (
 	"shared-album/internal/members"
 	"shared-album/internal/notifications"
 	"shared-album/internal/photos"
+	"shared-album/internal/settings"
 	"shared-album/internal/sharelinks"
 	"shared-album/internal/social"
 )
@@ -70,8 +71,9 @@ func TestPostgresContract(t *testing.T) {
 		Social:        social.NewStore(pool),
 		Notifications: notifications.NewStore(pool),
 		ShareLinks:    sharelinks.NewStore(pool),
+		Settings:      settings.NewStore(pool),
 		Reset: func(ctx context.Context) error {
-			_, err := pool.Exec(ctx, `TRUNCATE users, objects CASCADE`)
+			_, err := pool.Exec(ctx, `TRUNCATE users, objects, app_settings CASCADE`)
 			return err
 		},
 	})

backend/internal/repo/contract/sqlite_test.go

@@ -13,6 +13,7 @@ import (
 	"shared-album/internal/members"
 	"shared-album/internal/notifications"
 	"shared-album/internal/photos"
+	"shared-album/internal/settings"
 	"shared-album/internal/sharelinks"
 	"shared-album/internal/social"
 )
@@ -40,11 +41,12 @@ func TestSQLiteContract(t *testing.T) {
 		Social:        social.NewSQLiteStore(database),
 		Notifications: notifications.NewSQLiteStore(database),
 		ShareLinks:    sharelinks.NewSQLiteStore(database),
+		Settings:      settings.NewSQLiteStore(database),
 		Reset: func(ctx context.Context) error {
 			tables := []string{
 				"variant_jobs", "photo_objects", "objects", "photo_tags", "tags",
 				"refresh_tokens", "share_links", "notifications", "likes", "comments",
-				"invites", "album_members", "photos", "albums", "users",
+				"invites", "album_members", "photos", "albums", "users", "app_settings",
 			}
 			for _, tbl := range tables {
 				if _, err := database.ExecContext(ctx, "DELETE FROM "+tbl); err != nil {